Net Recon Following QuickAssist Execution
This rule detects the execution of 'net.exe' or 'net1.exe' with the command line containing 'time /domain' within 10 minutes after 'quickassist.exe' has been executed. This behavior can indicate an adversary performing system time discovery or domain reconnaissance after gaining initial access or establishing remote access via Quick Assist.
Cortex XDR
